Event ID 10021 and event ID 10016 occur after a site reset or after an SMS 2003 service pack installation on a site server running on Windows Server 2003 Service Pack 1 or Windows Server 2003 Service Pack 2

Consider the following scenarios:

• A Microsoft Systems Management Server (SMS) 2003 site server is installed on a computer that is running the release version of Microsoft Windows Server 2003. An SMS service pack may be installed. You upgrade the server to Windows Server 2003 with Service Pack 1 (SP1) or to Windows Server 2003 with Service Pack 2 (SP2).
• An SMS 2003 site server is installed on a computer that is running Windows Server 2003 with SP1 or Windows Server 2003 with SP2. An SMS service pack may be installed. You upgrade the SMS site server by installing an SMS 2003 service pack.
• An SMS 2003 site server is installed on a computer that is running Windows Server 2003 with SP1 or Windows Server 2003 with SP2. An SMS service pack may be installed. During maintenance or troubleshooting operations, you reset the SMS site server.

In each of these scenarios, the following error messages are logged when you try to initiate an action on a client computer from the site server.

Event message 1Event message 2

To resolve this problem, follow these steps:

1. Add the following local security accounts to the local DCOM Users group on the SMS site server or to the built-in DCOM Users group on a domain controller:
   • IWAM_servername
   • NETWORK SERVICE
   • SERVICE
   • SYSTEM
   • AUTHENTICATED USERS
   • INTERACTIVE
2. Give the IUSR_server name account security permissions. To do this, follow these steps:
   1. Click Start, click Run, type dcomcnfg.exe, and then click OK.
   2. Expand Component Services, expand Computers, right-click My Computers, and then click Properties.
   3. On the Com Security tab, click Edit Limits under Launch and Activation Permissions
   4. Under Group or user names, click Add.
   5. Type IUSR_server name, click Check Names, and then click OK.
   6. Under Group or user names, click the IUSR_server name.
   7. Under Permissions for IUSR_server name, click to select Allow for the following permissions:
      • Local Launch
      • Remote Launch
      • Local Activation
      • Remote Activation
3. Restart the site server.
4. Click Start, Click Run, type services.msc, and then click OK.
5. Under Services, right-click the following services, and then click Stop:
   • IIS Admin Service
   • World Wide Web Publishing Service
   • HTTP SSL
   • SMS Agent Host
   • SMS_EXECUTIVE
   • SMS_REPORTING_POINT
   • SMS_SITE_COMPONENT_MANAGER
   • SMS_SQL_MONITOR
6. Click Start, click Run type cmd, and then click OK.
7. At the command prompt, change the working directory to the \inetpub\adminscripts directory, type the following command, and then press ENTER:
   CSCRIPT SYNCIWAM.VBS -v
8. Restart all the services that you stopped in step 5.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

If the reporting point is hosted on a system that is running Windows Server 2003 with SP1, make sure that the SMS Reporting Users group has access to the SMS_REPORTING_POINT COM+ object. To do this, follow these steps:

1. On the site system, click Start, click Run, type Dcomcnfg.exe, and then click OK.
2. Double-click Component Services, double-click Computers, double-click My Computer, and then double-click DCOM Config.
3. Right-click SMS_REPORTING_POINT, and then click Properties.
4. On the Security tab of the SMS Reporting Point Properties dialog box, click Edit in the Launch and Activation Permissions section.
5. In the Launch and Activation Permissions dialog box, click to select Local Activation for the SMS Reporting Users group.

For more information about other issues that are related to DCOM permissions, click the following article numbers to view the articles in the Microsoft Knowledge Base: SMS 2003 relies heavily on DCOM to perform its designated tasks. One component of the SMS 2003 installation process makes sure that the Windows Server 2003 DCOM security settings are set to their defaults. These settings let SMS 2003 work well on a computer that is running Windows Server 2003 with no Windows Server 2003 service pack installed. Windows Server 2003 SP1 introduced significant changes to DCOM security configuration. The default DCOM security configuration in Windows Server 2003 SP1 and in later service packs are too restrictive to allow full SMS 2003 functionality. Therefore, when you install a Windows Server 2003 service pack on an SMS 2003 site server that did not previously have a Windows Server 2003 service pack installed, DCOM security configuration incompatibilities are introduced. These incompatibilities require manual intervention and configuration to make sure that SMS continues to function.

The same DCOM security configuration tasks are performed whenever an SMS 2003 service pack is installed and whenever a site is reset. DCOM security configuration rolls back to the default Windows Server 2003 settings for the version of Windows Server 2003. If Windows Server 2003 includes a service pack, you must manually reconfigure DCOM security settings to guarantee full SMS 2003 functionality.